CVE-2026-34945

Wasmtime is a runtime for WebAssembly. From 25.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime's Winch compiler contains a bug where a 64-bit table, part of the memory64 proposal of WebAssembly, incorrectly translated the table.size instruction. This bug could lead to disclosing data on the host's stack to WebAssembly guests. The host's stack can possibly contain sensitive data related to other host-originating operations which is not intended to be disclosed to guests. This bug specifically arose from a mistake where the return value of table.size was statically typed as a 32-bit integer, as opposed to consulting the table's index type to see how large the returned register could be. When combined with details about Wnich's ABI, such as multi-value returns, this can be combined to read stack data from the host, within a guest. This vulnerability is fixed in 36.0.7, 42.0.2, and 43.0.1.

Scoring

Severity

LOW

CVSS base score

2.3

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N

EPSS probability

0.32%

CWE

CWE-681

Published

2026-04-09

Last modified

2026-04-10

Affected products

• bytecodealliance wasmtime
• bytecodealliance wasmtime
• bytecodealliance wasmtime

Weakness type

• CWE-681

Related vulnerabilities

• CVE-2026-69438 — Microsoft JScript Remote Code Execution Vulnerability
• CVE-2026-84963 — Silent field truncation via unchecked int cast of huge JSON string values in JSON-to-BSON parser
• CVE-2026-84966 — BSON element injection via NUL-embedded document keys in builder append
• CVE-2026-84970 — Heap over-read or silent misparse via 32-bit truncation of JSON length in BSON JSON parser
• CVE-2026-82522 — libjxl < 0.12.0 Container Box Parser Integer Underflow via 32-bit Size Truncation
• CVE-2026-82457 — su-exec through 0.3 Privilege Escalation via Numeric User ID
• CVE-2026-75145 — FFmpeg Integer Narrowing Conversion OOB Memory Access in AV1 RTP Packetizer
• CVE-2026-19879 — Io.undertow/undertow: undertow: http response header integrity issue due to character truncation

Markdown version · Browse all CVEs